Navigation systems, e.g., microwave landing systems, are used to enable aircraft to make landings even in poor visibility. One distinguishes three categories of approach and landing manoeuvres. These categories are described in an article by Peter J. Wroblewski, "Development of Continuity of Service Requirements for the Microwave Landing System", The MITRE Corporation, MTR 86W243, Sep. 1987, on pages 2-1 and 2-2. Of particular importance are Category III operations, i.e., those in which the pilot depends exclusively on the navigation system, because he cannot see the runway. Throughout a Category III landing operation, it must be ensured that the navigation system does not fail, and that the information contained in the signals being radiated by the navigation system is reliable. The first-mentioned requirement is referred to as "continuity of service", and the second as "integrity".
To meet both requirements, i.e., to achieve high integrity and high continuity of service (COS), the navigation system includes redundant equipment. In addition, the signals radiated by the navigation system are monitored by two or more, generally two, monitors. The two monitors are executive monitors, i.e., monitors which initiate changeover or shutdown operations on the occurrence of an error in the radiated signals. In the prior art monitoring apparatus, monitors with identical sequences of operations are used, and a check is made to determine whether both monitors produce the same result. Such apparatus has the disadvantage that a fault in either of the monitors results in the two monitors indicating unequal results, so that the navigation system will be shut down. Thus, the COS is impaired by the use of two monitors with equal sequences of operation. Another drawback of the monitoring apparatus is apparent from the following. It may happen that the same fault occurs in both monitors at the same time. The outputs of both monitors then provide the same signals. In that case, an error in the signals being radiated by the navigation system can no longer be detected. The integrity of the system is thus impaired.